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Description 
Technical Field 

[0001] The present invention relates to method and 
system Tor controlling access from different Pervading 
Computing Devices (PVC-devlces) to applications in- 
stalled on or accessible via a server. 

Background of the Invention 

[0002] PVC-devices, e.g. personal digital assistants, 
mobile phones, chipcards etc., are frequently used to 
gather Information or to use business transactions ap- 
plications stored on server, e.g. application for electron- 
ic payments or application for electronic shopping, 
[0003] Wireless PVC-devlces like personal digital as- 
sistants and mobile phones communicate via gateway 
and Internet to a server which offers access to Web pag- 
es or business transaction application. Other PVC-de- 
vices like chipcards may use a LAN, Intranet or Internet 
to communicate with the said server. 
[0004] A main problem of communication between 
different PVC-devices and the business transaction ap- 
plications Is the security. Normally each business trans- 
action application may use Its own security require- 
ments depsndlng on the type of PVC-devfce, the type 
of user and type of communication, 
[0005] Security requirements may consist of an au- 
thentication level, a confidentiality level and an endorse- 
ment level. PVC-devices can establish a certain authen- 
tication level by performing appropriate authentication 
protocol and a certain level of confidentiality by employ- 
ing appropriate encryption to secure communication be- 
tween the server and certain level of endorsement 
[0006] Today, to applicant's knowledge, no secure, In- 
tegrated solution for security based access control from 
various PVC-devices to applications/functions on a 
server exists. Applications are mostly developed to sup- 
port few devices. Security requirements and authenti- 
cation code are mostly buried in the application oode. 
[0007] In current PVC-applIcations, it is difficult to add 
support for additional PVC-devlces and authentication 
mechanism, in most cases, applications allow for at 
most one authentication mechanism, mostly coupled 
with an application. 

[0008] International Patent Publication WO 00711 832 
discloses a global server which includes a communica- 
tions engine for establishing a communications link with 
a client; security means coupled to the communications 
engine for determining client privileges; a servlet host 
engine coupled to the security means for providing to 
the client, based on the client privileges, and applet 
which enables I/O with a secured service; and a key safe 
for storing a key which enables access to the secured 
service. The global server may be coupled to multiple 
sites, wherein each site provides multiple services. 
Each site may be protected by a firewall. Accordingly, 



the global server stores the keys for enabling commu- 
nication via the firewalls with the services. 
[0009] International Patent P ubllcation WO 00/02358 
discloses a method, apparatus, memory card, and sys- 

s tern for establishing a secure connection between a 
wireless communication apparatus and a data commu- 
nication apparatus based on a wireless application pro- 
tocol. The wireless communication apparatus Is provid- 
ed with contact means for receiving Information from a 

10 separate unit provided with memory means. The mem- 
ory means comprising information to control the access 
of the wireless communication apparatus through a 
wireless communication network connected to said data 
communication apparatus, 

13 [0010] rt Is therefore the object of the present inven- 
tion to provide a system and method for a secu rlty based 
access control from various PVC-dovlces to applica- 
tions which Is independent from any client or application . 
0)011] This object is solved by the features of the in- 

20 dependent claims. Preferred embodiments of the 
present invention are laid down In the dependent claims. 

Summary of the invention 

2s [001 2] The present invention relates to a client-server 
system having a security system for controlling access 
to application functions. The security system separated 
from the clients and tho application functions routes all 
Incoming requests created by various PVC-devices to 

so a centralized security system providing an authentica- 
tion component and a security component. The authen- 
tication component provides several authentication 
mechanism which may be selected by Information con- 
tained in the client's request. The authentication mech- 

33 anlsm may be changed or extended wtthout changing 
conditions on the client as well on the server or applica- 
tion side. The security component provides a security 
policy describing security requirements for accessing 
application functions which may be Invoked by the se- 

40 curity component. If the selected authentication mech- 
anism succeeds and fulfills the security policy associat- 
ed to that application function then the application func- 
tion will be invoked by the security component 
[001 3] In a preferred embodiment, the present Inven- 
ts tion provides a session object for each PVC-device that 
communicates with the server. One of the session ob- 
jects attributes Is a security state. The security slate at 
least Indicates the level of security of authentication 
and/or the level of confidentiality of communication with 

50 the PVC-devtee. The server has a security policy, that 
determines wnlch application function may be Invoked 
at what security level. Application functions on a server 
can only be Invoked via the Secure Pervasive Access 
Framework (§PAF). For each request to invoke a appll- 

55 cation function, SPAF checks whetherthe security state 
of the client device satisfies the access conditions de- 
fined in the security policy for that application function; 
only If this is the case, SPAF Invokes the requested ap- 
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plication function. 

[0014] Preferably all Incoming requests are routed 
through the Device Adaptation Layer. This layer in- 
cludes different kinds of gateways that convert device 
specific requests to a canonical form, I.e. HTTP re- 
quests that carry information about the device type and 
the desired reply content type, e.g. HTML, WML or 
VXML Examples of such gateways are voice gateways 
with a VXML browser that recognizes speech and gen- 
erates HTTP requests that carry text and selected op- 
tions or a WAP gateway that con nects the WAP protocol 
stack to the Internet protocol stack. 
[0015] SPAF checks all Incoming requests and in- 
vokes application function according to the associated 
security policies, which may be stored in a special da- 
tabase, for example. The security policies may be very 
different, for example one non-sensitive application 
function may only have functions that accessible to eve- 
rybody, while another application may have certain func- 
tions that may only be performed by clients that have 
been authenticated by the security module using a cryp- 
tographic protocol. 

[001 6] Calls of application functions by S PAF result In 
execution of application logic, maybe Including access 
to databases or legacy systems In the background and 
some output that must be delivered to the user. All In- 
formation to be displayed Is prepared by the application 
logic and passed to the content delivery module. The 
content delivery module renders this Information into 
content that depends on the device type and desired re- 
ply content type. 

Brief Description of the Drawings 

[001 7] The present Invention win be bettor understood 
and its numerous objects and advantages will become 
more apparent to those skilled in the art by reference to 
the following drawings, in conjunction with the accom- 
panying specification, In which 

FIG.1 shows a communication architecture in which 
the present invention may be used 

FIG. 2 shows the secure pervasive access architec- 
ture as used by the present Invention 

FIG.3 shows authentication and access via secure 
pervasive access as used by the present In- 
vention 

FIG. 4 shows the baste method steps of the present 
invention 

FIG.5 ehows the method of the delivery module as 
preferably used by the present invention 

FIG.6 ehows the method of the PVC-Proxy as pref- 
. erabty used by the present invention 



Detailed description of the preferred embodiment 

[001 8) Before going Into details of specific embodi- 
ments, it will be helpful to understand from a more gen- 
s eral perspective the various elements and methods 
which may be related to the present Invention. 
[001 9] An Important feature of the present invention 
Is the Secure Pervasive Access Framework (SPAF). 
SPAF builds the Interface to various components of the 
10 Invention. It receives the requests from the different 
PVC-devlces, checks the security state of the respective 
PVC-device end gives access to the requested ftinc- 
tione/applloatlon If the access conditions defined by the 
security policy are fulfilled. The security state of the ro- 
te spcctive PVC-devlce may be checked by own pn> 
grams, e.g. plug-Ins, using authentication mechanism 
Hkepassword/userlD, challenge response, digital signa- 
ture and so on. These plug-ins are totally independent 
from any application/function to be accessed. Access to 
20 an application/function will be exclusively controlled by 
the SPAF via the security policy. Security level of a cer- 
tain applloatlon/f unction may be changed without 
changing application function to be accessed. The ap- 
plication logic itself remains unchanged. This Is an Im- 
25 portant advantage of the present Invention. 

[0020] Another feature of the present Invention - 
which may beused optionally - Is the Device Adaptation 
Layer (DAL). 

[0021] It receives device specific requests and gener- 
ate ates a canonical form which Is able to specify informa- 
tion about the device type and the desired reply content. 
The inf conation contained In the canonical request (a 
used for executing the respective authentication mech- 
anism by using the appropriate plug-In* The DAL Is able 
35 to support any protocol, e.g. HTTPS and WAP. 

[0022] FIG .1 provides a view of a communication ar- 
chitecture In which the present Invention may be used 
preferably. Currently many PVC-devlces (6) are availa- 
ble on the market. The famous PVC-devlces are per- 
<0 sonal digital Ejselstants, mobile phones or WAP phones 
and chlpcards. 

[0023] One Server (2) hosts application functions (1 ) 
which may be' accessed from different PVC-devlces (6) 
with different levels of authentication and different levels 
45 of confidentiality od exchanged data. The other server 
hosts a PVC : Proxy (3), the Voice Gateway (4) and the 
WAP Gateway (5). 

[0024] The PVC-Proxy (3) allows to establish connec- 
tions to different kinds of PVC-devlces (6) and maintains 

so session Information (cookies) and device type informa- 
tion for these connections. Connections to clients can 
be established directly or via the Voice Gateway (4) or 
WAP Gateway (6). Each Incoming request is augment- 
ed by the session and devices type information before 

55 forwarding it to its destination. 

[0026] The Voice Gateway (4) Includes speech rec- 
ognition and speech synthesis. It converts voice input 
from a telephone to HTTP requests and responses con- 
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taining VXML-itke content back to voice. 
[0028] The WAP Gateway (5) forwards WAP requests 
as HTTP requests to a server and returns the HTTP re- 
sponses to devices as WAP responses. 
[0027] Which content representation has to be used 
for a particular request is determined by the device info 
thai comes with each request Whfch session Info has 
to be used Is determined by the cookie information that 
is contained in each request. Setting the cookie Infor- 
mation and the device Info to appropriate values is the 
responsibility of the PVC-Proxy, 
[0028] FIG.2 provides drawing of a preferred imple- 
mentation of a secure pervasive access architecture. 
[0029] The secure pervasive access architecture 
preferably comprises following components: 

a Device Adaptation Layer (DAL; 26) as gateway 
for the different PVC-devlces (20) 

authentication component (27) comprising one or 
more security plug-Ins (SP£3) for executing au- 
thentication mechanism 

a Secure Pervasive Access Framework (SPAF; 29) 

a security policy (30) which is preferably laid down 
in a data base (31 ) accessible by the server 

several access protected application functions (32) 
located on the server or on a data base (33) acces- 
sible by the server 

[0030] The communication structure between these 
components is as follows: The single PVC-device (20) 
generates a device specific request and sends it to the 
DAL (26). Requests are routBd through the DAL. Pref- 
erably DAL includes different kind of gateways that con- 
vert device specific requests into a canonical form, e.g. 
HTTP requests that includes information about device 
type and desired reply content type, e.g. HTML, WML 
or VXML. The appropriate security plug-ins (28) is se- 
lected based on the information contained in the request 
and an authentication mechanism as laid down in the 
selected security plug-In (28) will be executed. The re- 
sult of the authentication for the PVC-devlce called se- 
curity state is stored In a non-volatile memory of the 
server. Then, the SPAF (29) compares the security state 
of a PVC-device with the associated security policy (30) 
for that application function (32) and invokes application 
function (32) according to the security policy. The secu- 
rity policy (30) comprises correlation of security levels 
concerning defined user-actions for accessing applica- 
tion functions. For example, the security policy may be 
Implemented In a table In which each application func- 
tion could have one or more correlation of security level 
concerning defined user-actions of that application func- 
tion. The security policy may be different depending 
from the type of information to be accessed or type of 



PVC-devlce. For example one non-sensitive application 
function may, only have function accessible to every- 
body, while another application function may have func- 
tions that may only be performed by PVC-devlces that 

5 have been authenticated by the security plug-Ins or se- 
curity modules using cryptographic protocol. The secu- 
rity policy may be stored in a special data base. 
[0031 ] SPAF compares security state delivered by the 
security plug-in with security policy associated with the 

10 respective application function. If the security state of 
the PVC-device satisfies the access conditions defined 
by the security policy the SPAF Invokes the requested 
application function. 

[0032] FIG. 3 provides a drawi ng showing authentica- 
te tlon and access via secure pervasive access. 

[0033] PVC-devlces (34) ilke mobile, personal digital 
assistants, chlpcards generates a device specific re- 
quest and sends that request to the DAF (39). If a con- 
version is required DAF converts the device specific re- 
20 quest Into a canonical request including a cookie. A 
cookie contains a packet of Information which the server 
sends to DAF or the PVC-devlce to be sent back by the 
DAF or PVC device every time It reconnects with the 
that server. Cookies are mainly used to authenticate the 

6 PVC-devlce against the server. Some PVC-devlces do 
not support handling of cookies, e.g. WAP phone or per- 
sonal digital assistant. For these devices DAF (39) of- 
fers the functionality to support cookies. 

[0034] Cookies will be generated as follows: PVC-de- 
30 vice Initiates by means of requests a communication via 
DAF (If necessary) with the SPAF (40) offering access 
to applications. The request contains Information for au- 
thentication of the PVC-devfce, e.g. user ID and/or pass- 
word. 

35 [0035] Security plug-in or authentication sen/lets (36) 
using a specific authentication mechanism and If the au- 
thentication succeeds then the SPAF (40) creates a new 
session object with an associated session ID (43). Then 
the SPAF (40) uses the security state for the already 

40 authenticated PVC-devlce comprising result of the au- 
thentication and authentication Information or parts of It 
contained In the request of the PVC-devlce and puts the 
security state (42) Into the session object. SPAF (40) 
assigns a session ID to the PVC-devlce and returns a 

45 response with a cookie containing the sesslonlD. The 
PVC device or DAF receives the response and stores 
the cookie. Etjch subsequent request send back by the 
PVC device to the SPAF contains that cookie. 
[0036] PVC-device (34) sands new request to the 

co SPAF to access an application function, e.g. query con- 
fidential Information. SPAF gets the sesslonlD from the 
cookie contained In that request, looks for the session 
object associated with that sesslonlD from the cookie 
and gets the security state contained in that session ob- 

55 ject. Then , SPAF checks security state contained In that 
session object with the security policy (41). If the secu- 
rity state (42)sarjsfles the security policy (41)the SPAF 
invokes the requested application function and returns 



4 



PACE 6/15 * RCVD AT 1 1/2/2007 5:31 :33 PM [Eastern Daylight Time] * SVR:USPTO-EFXRP-8/20 * DNIS:273830O * CSID:7035185499 * DURATION (mm-ss):03-56 



11/02/2007 FRI 1 6.8.33 _.FAX„ 7 0351 8 5499 ......rr„^P..^!^.^.i? 3 l 



7 EP 1 158 745 B1 8 



a response. The PVC-device displays the response. 
[0037] FIG.4 provides a diagram showing the basic 
method steps of the present invention. 
[0038] The basic method comprises the step of "get 
security state from the session (45)" , checking the re- 
ceived security state with the security policy (46) and 
calling the requested application function (47) If the se- 
curity policy allows access to that application function. 
The security state will be preferably handled by security 
plug- Ins as already explained above. Each plug-In con- 
tains oneauthentfcatlon mechanism, e.g. authentication 
by userlD/password, Challenge/Response, digital sig- 
nature. The plug-Ins are Independent from the applica- 
tion function to be Invoked. 

[0039] The method steps for checking the received 
security state and allowing access to the desired appli- 
cation function are laid down in the Secure Pervasive 
Access Framework (SPAF). SPAF has an common In- 
terface to the accessible application functions. 
[0040] FIG.6 provides the method steps of the Deliv- 
ery Module for each outgoing response. 
[0041] The Delivery Module renders the information 
into content that depends on the device type and desired 
reply content type. Which content of representation has 
to be used for a particular request Is determined by the 
device Info contained In each request (61 , 62). For each 
content type, e.g. HTML, WML or VXML, there are dif- 
ferent kind of Java Server Pager (JSPs) for content ren- 
dering. JSP can be used to generate arbitrary content 
by using the appropriate JSP tag to define the desired 
content type (63, 64). 

FIG.6 provides the baBtc functionality of the PVC proxy. 
As already explained above the PVC-proxy support 
those PVOdevtees which do not support handling of 
cookies. Proxy receives the cookies sent by the server 
and Includes the cookie in the request of the appropriate 
PVC-devlce. 

Furthermore, the PVC-proxy converts the PVC-devlce 
specific requests into canonical requests as far it Is re- 
quired. 



Claims 

1 . Security system for controlling access to application 
functions (32;44) located on a server or accessible 
via a server, wherein clients (20; 34) communicate 
with s aid server by means of requests for accessing 
one of said application functions (32; 44) using 
wired, wireless, or partly wireless network, wherein 
access to said application functions Is controlled by 
security requirements, characterized In that 

an authentication component (27) functionally 
separated from said clients (20; 34) and said 
application functions (32; 44) for processing cli- 
ent's request Independently of clfent's type, 
contalnl ng different authentication mechanism 



(28) end selecting and executing an authenti- 
cation mechanism (28) based on the informa- 
tion contained in the client's request resulting 
tn a security etate (42); 

5 

a security component (29; 40) containing a se- 
curity. poDcy (30; 41) describing security re- 
quirements, e.g. security level, for accessing 
application functions, comparing security state 
10 (42) associated to a client with the security level 

of the application function and allowing access 
to the specified application function If the secu- 
rity state fulfil Is the requirements of the security 
level. 

2. System according to claim 1 , characterized In that 
said clients (20; 34) are PVC-devtces. 

3. System according to claim 1 , characterized In that 
20 said authentication component (27) and said secu- 
rity component (29; 40) are Integrated in one com- 
ponent stored on a server. 

4. System according to claim 1 , characterized In that 
23 said authentication component (27) consists of se- 
curity plug-Ins (28) whereby each authentication 
mechanism is laid down In a separate security plug- 
In. 

30 5. System according to claim 4, characterized In that 
the authentication mechanslm (28) may be UserlD/ 
Password, Challenge/Response or digital signa- 
ture. 

35 6. System according to 2 further characterized In 
that: 

. a component (28; 39) for converting PVC-de- 
vice specific requests into canonical requests 
ao before said request Is used by said authentica- 

tion component (27), 

7. Method for controlling access to application func- 
tions stored on a server or accessible via server, 

45 wherein clients communicate with said server by 
means of requests for accessing one of said appli- 
cation functions using wired, wireless or partly wire- 
less network, whereby access to said application 
functions is controlled by a security requirements, 

so characterized by the steps of: 

routing all Incoming requests created by said 
clients (26; 34) to an authentication component 
(27) which Is f unctlonaJiy Independent from said 
ss clients and said application functions (32; 44), 

said authentication component (27) comprises 
the steps of: 
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authentication of said client by determining 
an authentication mechanism provided by 
said authentication component by means 
of authentication Information contained in 
add request and applying said authentica- 
tion mechanism 

storing result of said authentication and 
said authentication Information or parts of 
it contained in said request (security state) 

using security requirements for application 
function to be accessed 

comparing stored security state (42) with 
said security requirements (41 ) for access- 
ing the requested application function 

invoking requested application function if 
security state fulfills said security require- 
ments. 

8. Method according to claim 7 characterized in that 

said incoming requests are canonical requests. 

9. Method according to claim 8 characterized In that 
said canon leal requests are created by a Device Ad- 
aptation Layer (2B; 39) which converts client spe- 
cific requests into canonical requests. 

10. Method according to claim 7 further characterized 
by steps of: 

creating a session identifier (43) when estab- 
lishing a communication between a client and 
a server and using said session identifier In all 
requests and responses between said client 
and said server. 

11. Method according to claim 10 characterized In 
that said session Identifier (43) and said security 
state (42) are laid down In a cookie, whereby said 
cookie te Inserted Into each request and response 
between client and server. 

12. Method according to claim 7 characterized in that 
said clients are PVC-devices. 

13. A computer program characterized by computer 
program code portions for performing respective 
steps of the method according to claim 7 to 1 2 when 
the program is executed in a computer. 

14. Computer program product stored on a computer- 
readable media containing software code for per- 
forming of the method according to one of the claim 
7 to 12 If the program product Is executed on the 
computer. 
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PatcntanaprQche 

1. Eln Stcherheitssystem zum Steuem des Zugangs 
zu Anwendungsfunktlonen (32, 44), die slch auf el- 

5 rem Server befinden Oder auf die Ober einen Server 
zugegriffen werden kann, wobel Clients (20, 34) mlt 
dem genannten Server kommunlzleren mlthllf e von 
Mltteln zur Anfbrderung fur elnsn Zugang zu elner 
der genannten Anwendungsfunktlonen (32, 44) un- 

10 ter Verwendung elnes verdrahteten, drahtlosen 
odertellwebe drahtlosen Netzwerks, wobel der Zu- 
gang zu den genannten Anwendungsfunktlonen 
dutch Slcherheltsanforderungen geeteuert wlrd, 
dadurch gekennzeJchnet, daes 

« elne Identlfikatlonskomponente (27) funktlonal von 
den genannten Clients (20, 34) getrennt 1st und die 
genannten Anwendungsfunktlonen (32, 44) zum 
Verarbetten der Cllent-Anforderungen vom Client- 
iyp unabhangig sind und einen anderen IdenUfika- 

20 tionsmechanismus (28) onthalten und einen Idontl- 
, flkatlonsmeohanfsmus (28) baslerend auf den In 
der Client-Anfordorung onthaltenen Informatlonen 
auswahlen und ausfuhren, was einen Sichemeita- 
status (42) ergibt, 

25 eine Sicherheitskompononte (29, 40) Sichomoits- 
vorgaben (30, 41) enthalt, die Sicherheftsanferde- 
rungen beechreiben, beispielsweise eine Sicher- 
heitsstufe, auf Anwendungsfunktionenzugreift, den 
Sichemeitsstatus, der eln em Client mit der Sioher- 

30 heltsstufe der Anwendungsfunktlon zugeordnet 
wird, verglefcht und den Zugang zur angegebenen 
Anwendungsfunktlon gestattet, wenn der Sicher- 
heitsstatus die Anforderungan der Sbhemeitsstufe 
erfOlft. 

33 

2. Eln System nach Anspruch 1, dadurch gekenn- 
zelchnet, dasa es slch bel den genannten Clients 
(20, 34) urn PVC-Gerfite handelt. 

40 3. Eln System nach Anspruch 1 , dadurch gekenn- 
zelchnet dass die genannte Identlfi kattonskompo- 
nente (27) und die genannte Sicherheitskomponon- 
te (29, 40) in einer Komponente integrlert sind, wel- 
cho auf etnem Server gespelchert 1st. 

46 

4. En System nach Anspruch 1, dadurch gekenn- 
zelchnet, dass die genannte Identiflkattonekompo- 
nente (27) aus SIcherheltB- Plug-Ins (28) bsBteht, 
wobei sich jeder Identlfikationsmechanismus in el- 
50 nem separaten Sicherheits-Plug-ln befindet. 

6. Eln System nach Anspruch 4, dadurch gekenn- 
zelchnet, dass ss sich be* dem identlfikationsme- 
chanismus (2fl) urn Benutzer-ID/Passwort, Chai- 
ns lenge/Response Oder digitals Slgnatur handeln 
kann. 

6. Eln System nach Anspruch. 2, welterhin dadurch 
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11 EP115S 

gekennzelchnet, dass: 

elne Komponente (26, 39) zum Konvertieren 
PVC<3erlttespezifischer Anforderungen In ka- 
nonische Anforderungen von der genannten s 
Identifikationskomponenle (27) verwendet 
wird. 

7. Elne Methode zum Steuern dee Zugangs zu An- 
wendungsfunktlonen, dlesich auf efnem Server be- io 
tinden Oder auf die iiber eln en Server zugegrlffen 
werden kann, wobei Clients rnlt dem genannten 
Server kommunlzleren mlthiife von Mftteln zur An- 
forderung fDr einen Zugang zu elner der genannten 
Anwendungsfunktlonen untor Verwendung elne© 1 3 
verdrahteten, drahtlosen odertellwelse drahtloaen 
Netzwerks, wobel der Zugang zu den genannten 
Anwendungsfunktlonen durch Sfctiertietteenforde- 
rungen gesteuert wird, durch fotgende Schritte ge- 
kennzeichnet: 20 

Weiterleiten allerelngohendon Anforderungen, 
die von den genannten Clients (26, 34) erstellt 
und an eine Identiflkatlonskomponente (27) ge- 
geben wurden, die Tunktlonal unabhdnglg 1st & 
von den genannten Clients und den genannten 
Anwendungsfunktlonen (32, 44), wobel die ge- 
nannte Identifikationskomponente (27) folgen- 
de Schritte umfasst: 

30 

Identifikation des genannten Clients durch 
Bestimmen eines Identifikationsmechanis- 
mii3, der von der genannten Identifikati- 
onskomponente bereitgeatellt wird, mithil- 
fe von Identffikatlons-lnformationen, die ss 
sich in der genannten Anforderung befin- 
den und durch Anwenden des genannten 
! dentin" kations mechanism us, 

Speichern des Ergebnisees der genannten 40 
Identifikation und der genannten IdentHlka- 
tions-lnformationen oder von TeDen davon 
In der genannten Anforderung (Slcher- 
haftsstatus), 

45 

Varwenden der Sicherheitsanforderungen 
fOr den Zugang zur AnwendungsfunkHon, 

Verglelchen des gespeicherten S'tcher- 
heltsstaius (42) mlt den genannten Slcher- co 
heftsanforderungen (41) zum Zugang zur 
angeforderten Anwendungsf unktlon , 

Aufrufen der angeforderten Anwendungs- 
funktlon, wenn der Slcherheitsstatus die ss 
genannten Sfcherheltsanforderungen er- 
fOllt 
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8. Elne Methods nach Anspruch 7, dadureh gekenn- 
zelchnet, dose es sfch bal den genannten elnge- 
hen den Anforderungen um kanonlsche Anforde- 
rungen handelt 

y 

9. Elne Methode nach Anspruch B, dadureh gekenn- 
zelehnet, dass die genannten kanonlschen Anfor- 
derungen von einer Device Adaption Layer (26, 39) 
erstellt werden, die die Cllent-spezifischen Anforde- 
rungen in kanonische Anforderungen konvertiert. 

10. Elne Methode nach Anspruch 7, welter h in durch fol- 
gende Schritte gekennzelchnet 

Eretellen einer Sitzungs-Kennung (43) beim 
Herstellen efner Kommunikatlon zwlschen el- 
nem Client und elnem Server und Verwenden 
der genannten Sitzungs-Kennung In alien An- 
forderungen und Antworten zwlschen dem ge- 
nannten Client und dem genannten Server. 

11. Elne Methode nach Anspruch 10, dadureh ge- 
kennzelchnet, dasB die genannte Sitzungs-Ken- 
nung (43) und der genannte Slcherheitsstatus (42) 
In elnem Cookie festgehalten warden, wobel der 
Cookie in jede Anlorderung und Antwort zwlschen 
dem genannten Client und dem genannten Server 
elngefdgt wlrd. 

12. Elne Methode nach Anspruch 7, dadureh gekenn- 
zelchnet, dass es slch bel den genannten Clients 
um PVC-Gerdte handett 

13. Eln Computorprogramm, gekennzelchnet durch 
Computerprogrammcodeteile zum AusfQhren der 
entsprechenden Schritte der Methode nach An- 
spruch 7 bis 12, wenn das Programm auf elnem 
Computer ausgefUhrt wird. 

14. Eln Computerprogramm, gespeichert auf elnem 
Computerlesbaren Medium mlt Softwarecode zum 
AusfQhren der Methodenschrltte nach elnem der 
AnsprQche 7 bis 12. wenn das Programm auf elnem 
Computer ausgefQhrt wlrd. 



Revendleatione 

1 . Systeme de securite destine a commander I'acces 
a des fonctions d'application (32 ; 44) situees sur 
un serveur ou accesslblee par rintermedlafro d'un 
serveur„dans (equal des clients (20 ; 34) communi- 
quent avec fedlt serveur au moyen de requdtes pour 
acceder a Tune desdites fonctions d'application • 
(32 ; 44) en utlllsant un reseau cable, sans til, ou 
partlel lament cable, dans lequel I'acces auxdites 
fonctions d'application est commande par des exi- 
gences de securite, caraderlse en ee que : 
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un composant d'authentiflcation (27) separe 
fonctlonnellement desdlte clients (20 ; 34) et 
desdites fonctlons d'application (32 ; 44) desti- 
ne a trader la requete du client Independam- 
ment du type du client, contertant dlff erents me- s 
canlsmes d'authentiflcation (26) et destine a 
eelectlonner et a executer un mecanlsme 
d'authentiflcation (28) fonde* sur lea informa- 
tions contenuee dans ta requete du client resul- 
tant en u n etat de securite (42), 1 o 

un composant de eeourlte (29 ; 40) contonant 
una politique de securite (30 ; 41) decrlvant des 
exigences de security, par exemple, un niveau 
de security pour acceder a des fonctlons d'ap- ' 3 
plication en comparant un etat de securite (42) 
assccle a un client avec le niveau de security 
de la fonction d'application, et en permettant 
I'acces a la fonction d'application specifier si 
I'&tat de s6curfte remplit les exigences du nl- so 
veau de securite. 

Systeme selon la revendication 1 , caracterlse en 
ce que lesdfts clients (20 ; 34) sent des disposltlfs 
de type PVC (circuit vfrtuel permanent). 26 

Systeme selon la revendication 1 , caractertse en 
ce que le composant cfauthentlficatlon (27) et ledit 
composant de securite (29 ; 40) sont Iniegres en un 
eeul composant memorise sur un serveur. so 

Systeme selon la revendication 1 , caracttrlse en 
ce que le composant d'authenlification (27) est 
constltue de modules d'extenslon (28) par lesquels 
chaque mecanlsme d'authenlification est piac6 S5 
dans un module d'extenslon de securite separe. 



ces auxditesfonctions duplication est commands 
par des exigences de security caractlrtse par les 
stapes consistant a : 

acheminer toutes lea requetes entrantes 
creees par leedits clients (28 ; 34) vers un com- 
posant cf authentlf Icatlon (27) qui est fonctlon- 
nellement Independant dead Its clients etdeadl- 
tes fdnctions d'application (32 ; 44), ledtt com- 
posant d'authentiflcation (24) comprend les 
etapfcs consistant a : 

authentffler ledtt client en determinant un 
mecanlsme d' authentlf icatlon fouml par le- 
dft composant d'authenlification au moyen 
d' Informations cfauthentlficatlon conte- 
nuea dans ladtte requete et appllquer ledtt 
mecanlsme d'authentiflcation 

memorlaer le resuftat de ladite authenttfl- 
catlon et lesdltes Informations cf authenti- 
cation ou parties de celles-ci contenues 
dans ladite requete (Stat de securite) 

utiliser les exigences de securite pour la 
fonction d'application a laquelle II dolt etre 
fait accee 

comparer I'etat de security memorise (42) 
auxdites exigences de sdcurite (41) pour 
acceder a ladite fonction d'application de- 
manded 

appeier la fonction d'application demandee 
si I'etat de securite remplit lesdltes exigen- 
ces de securite. 



Systeme selon la revendication 4, caractertee en 
ce que ie mecanlsme d'authentiflcation (28) peut 
etre un Identiflcateur d'utiilsateur/mot de passe, un 40 
deWreponse ou une signature numerlque. 

Systeme selon la revendication 2 caracterlse en 
outre en ce que : 



un composant (2B ; 39) destine a convartlr des 
requetes speclfiques cfun dispositif de type 
PVC en des requetes autorisees avant que la- 
dite requete soit utiiieee par ledit composant 
d'authentiflcation (27). 



Proceed destine a commander I'acces a des fonc- 
tlons d'application memorisees sur un eerveur ou 
accessibles par dntermedlaire du serveur, dans le- 
quei des clients communiquent avec ledit serveur 
au moyen de requetes pour acceder a rune dasdl- 
tes fonctlons d'application en utillsant un reseau ca- 
ble, sans fil ou partiellement cable, par lequel I'ac- 



50 



35 



Proceed selon la revendication 7, caracterle6 en 
ce que lesdltes requetes entrantes sont dee reque- 
tes autorisees. 

9. Precede selon la revendication 8, caracterls6 en 
ce que lesdltes requetes autorisees sont creees 
par une couche d'adaptation de dlsposltff (26 ; 39) 
qui convertit des requetes specifiques de client en 
des requetes autorisees. 

10. Precede- selon la revendication 7, caracterisg en 
outre par les dtapes consistant a : 

creer un identiflcateur de session (43) lors de 
I'etablissement d'une communication entre un 
client etun serveur, et utiliser ledit identiflcateur 
de session pour toutes les requites et respon- 
ses entre (edit client et iedlt serveur. 

11. Precede selon la revendication 10, caracterlse en 
ce que ledit idontrf icatour de session (43) et ledit 
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15 EP 1 158 745 B1 16 

etat de eecurfte (42) sont places dans un program- 
me mouchard, grace a quo! ledit programme mou- . : 
chard eat Insere dans cnaque requete at reponse 
entre le client et ie eerveur. 

5 

12. Procedd eeion la raven d [cation 7, earacterle* en 
ce que iesdits clients sont dee dlspositifs de type 
PVC. 

13. Programme Informatique caracterls© par des par- 10 
ties de code de programme informatique destinees 

a executerdes etapee respectlves du precede so- 
lon les revendicatlons 7 a 12 lorsque le programme 
est execute darts un ordinateur. 

15 

14. Produit de programme informatique memorise eur 
un support pouvant etre lu par ordinateur contenant 
un code de logiclel destine a executer le precede 
selon Cure des revendicatlons 7 a 12 si ie produit 
de programme est execute dans I'ordlnateur. 
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